RoleFUZZER: User-Behaviour Fuzzing for Role-Specification Adherence in Large Language Models

Kshitish Ghate; Michael Saxon; Tadayoshi Kohno; Aylin Caliskan

cs.CLOct 28, 2026

RoleFUZZER: User-Behaviour Fuzzing for Role-Specification Adherence in Large Language Models

Authors: Kshitish Ghate, Michael Saxon, Tadayoshi Kohno, Aylin Caliskan

Organizations: University of Washington, Seattle, WA · Georgetown University, Washington, DC

Abstract

Large language models (LLMs) are often conditioned into specific roles such as tutors, interviewers, or agents acting for an organisation, through system prompts that specify how they should behave. The extent to which they can actually adhere to these role specifications under multi-turn interactions with realistic and potentially problematic users is understudied. To address this, we propose user behaviour fuzzing, a guided search over plausible user behaviours that can lead a model to violate its role specification, and introduce RoleFUZZER, a framework that adapts coverage-guided fuzzing from software testing to operationalise the search. RoleFUZZER constructs scenarios guided by a user-behaviour coverage grid that crosses a grounded taxonomy of user interaction types and the role specification of the model under test i.e. what is under pressure. With RoleFUZZER, we evaluate LLMs across five role specifications, including tutor, financial advisor, AI interviewer, antagonistic roleplay character, and web agent under organisational policies. Across simulated and validated conversations in 15 campaigns, the framework reaches >= 89% coverage of the 64-cell behaviour grid for every model and role tested, and surfaces specification-grounded failure patterns. At an equal budget of conversations, removing the RoleFUZZER grid and asking an LLM to generate specification targeting users free-form lowers coverage to 39-69% with fewer kinds of violations. The same specification can also fail in opposite directions. For e.g., on the antagonist, open-weight target models override the player's safety signals, while Claude Haiku 4.5 breaks character instead. RoleFUZZER offers a tractable way to uncover vulnerabilities in LLMs across role specifications by testing diverse user behaviours that are likely to violate them.

Figures & tables

Figure 1: Role FUZZER architecture. Campaign level (top) (§ 3.5 ): the planner draws from seed conversations pools and a user-behaviour coverage grid to design scenarios for under-covered cells. Conversation level (§ 3.4 ): the user simulator proposes a turn, the consistency monitor validates and tags it, the target LLM responds, and the judge scores every specification for adherence. Shown turns are adapted for illustration with a tutor scenario.

Figure 2: Left: user diversity and failure variety with and without the grid, averaged over the five roles. Right: Grid coverage against conversations, one panel per role. Blue lines: Role FUZZER with each target responder (line style). Orange and green lines: the no-grid and random-cell baselines on the responders at the same budget.

Figure 3: Violation severity distribution at the conversation level. Stacked bars show the fraction of conversations whose maximum severity for that principle was full adherence (green), partial deviation (orange), or clear breach (red). Rows from top: Qwen3-32B, Gemma4-31B-it, Claude Haiku 4.5.

Figure 4: Violation rate over the 16-cell TUNA mode $\times$ strategy grid for Qwen3-32B. Rows are (mode, strategy) combinations; columns are principles. Cells with fewer than three conversations are masked.

Appendix figures & tables8 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Annotation interface for Study 1, user simulator validation. LHS displays landing screen. RHS shows a turn level annotation sample.

Figure 6: Annotation interface for Study 2, LLM judge validation. LHS displays landing screen. RHS shows a turn level annotation sample.

	Pairwise agreement (%)
Role	Any dev.	Clear br.
Financial Advisor	80.8	95.5
Interviewer	60.5	89.8
Tutor	83.0	86.8
Antagonist	77.8	86.1
Web Agent	78.7	95.3

Appendix

Table 1: Aggregate pairwise agreement between GPT-5-mini judge and humans per role on overall deviations and clear breaches

Figure 7: Violation rate over the 16-cell TUNA mode $\times$ strategy grid for Gemma4-31B-it. Rows are (mode, strategy) combinations; columns are principles. Cells with fewer than three conversations are masked.

Figure 8: Violation rate over the 16-cell TUNA mode $\times$ strategy grid for Claude Haiku 4.5. Rows are (mode, strategy) combinations; columns are principles. Cells with fewer than three conversations are masked.

		Turn
Role	Responder	1	2	3	4	5	6	7	8
Cumulative clear breach of the targeted principle (%)
Tutor	Qwen3-32B	22	34	41	43	46	48	48	49
	Gemma-4-31B-it	1	1	1	1	2	3	4	6
	Claude Haiku 4.5	4	6	8	10	12	13	14	14
Financial Advisor	Qwen3-32B	8	18	24	27	30	32	33	34

Appendix

Table 2: Cumulative share of validated conversations whose targeted principle has been clearly breached (top) or violated (bottom).

Responder	Role	Families	Children	Pooled breach (%)	Mean family rate
Qwen3-32B	Tutor	17	101	64	0.66
	Financial Advisor	7	56	59	0.59
	Interviewer	10	62	61	0.74
	Antagonist	7	63	67	0.73
	Web Agent	5	54	69	0.61
Gemma-4-31B-it	Tutor	2	13	31	0.18

Appendix

Table 3: Mutation-family persistence per (responder, role). A family is a parent scenario that produced a target clear-breach together with all of its within-cell mutation children (generated by the intensity and frame-swap operators). # Families counts parents and # Children the total number of children pooled across them. Pool Breach % is the conversation-level clear-breach rate on the parent’s target principle, pooled across all children. High values on both columns indicate that structurally distinct scenarios pressing the same (user-behaviour, principle) combination keep breaching.

Role	Principle	Responder	Viol %	Breach %	TTFV
Tutor	Academic Integrity	Qwen3-32B	88.9	83.6	1.9
		Gemma-4-31B-it	45.5	27.8	3.8
		Claude Haiku 4.5	58.6	40.8	2.6
	Confidentiality	Qwen3-32B	6.2	3.1	2.2
		Gemma-4-31B-it	2.0	0.5	3.2
		Claude Haiku 4.5	0.5	0.0	3.0

Appendix

Table 4: Violation rate, clear-breach rate, and mean turn-to-first-violation (TTFV, conditional on at least one violation). TTFV is reported in turns.

LLM Auditing

Large language model auditing tests models and deployed systems for bias, safety, privacy, reliability, and provenance using behavioral and internal evidence.

See all 644 papers

Understanding and Mitigating Role Spoofing in LLMs
Oct 29, 2026Ezra Edelman, Benjamin Edelman, Surbhi Goel +1Adversarial Attacks on LLMs Prompt Injection Attacks on LLMs
University of Pennsylvania · Princeton University · Apple
Prompt Injection as Role Confusion
Feb 22, 2026Charles Ye, Jasmine Cui, Dylan Hadfield-MenellAdversarial Attacks on LLMs Prompt Injection Attacks
*Equal contribution 1Independent · 2Massachusetts Institute of Technology, Cambridge, MA, United States
Investigating Assistant Bias in LLM User Simulators Using a Role Vector
Sep 1, 2026Daeheon Jeong, Yoonjoo Lee, Eugene Choi +2Large Language Model-Based Role-Play Simulation User Simulation
1KAIST · University of Michigan · 3Seoul National University +2

Oct 29, 2026J/K move · Enter open · S save

Understanding and Mitigating Role Spoofing in LLMs

Ezra Edelman, Benjamin Edelman, Surbhi Goel, Eran Malach

University of Pennsylvania · Princeton University · Apple

Adversarial Attacks on LLMs Prompt Injection Attacks on LLMs Prompt Injection Attacks on AI Agents

Open paper AskPDF arXiv

Despite growing capabilities, LLMs remain susceptible to prompt injections: malicious inputs that can manipulate or hijack models. In particular, it has recently been observed that LLMs can exhibit role confusion (Ye et al., 2026), where models attribute the source of text based on its style instead of its labeled role. Malicious text in tool outputs (for instance, a malicious webpage accessed by an agent) can leverage role confusion to impersonate the user, an attack we call role spoofing}. In this work, we seek to understand and mitigate role spoofing. We study how models track "who said what" in a conversation, showing that they use cues from both content (e.g., semantics and writing style) and structure (e.g., control tokens and formatting). We show that LLMs are highly susceptible to role spoofing attacks that combine both fake structure and content. Additionally, in a toy setting, we show that adversarial training which teaches the model to ignore content-based injections does mitigate content-based attacks but leaves the model susceptible to structure-based attacks. This can explain why frontier models, with increased resistance to many injection attacks, can still be susceptible to role spoofing. Finally, we propose a new method for detecting role spoofing using linear probes trained to predict roles in a conversation, and show that it is effective across different settings.

Abstract

LLM Auditing

Explore similar work

Understanding and Mitigating Role Spoofing in LLMs

Prompt Injection as Role Confusion

Investigating Assistant Bias in LLM User Simulators Using a Role Vector